China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors

Cybersecurity researchers have disclosed a previously undocumented China-aligned threat cluster known as Bronze Sandcastle, which has been targeting organizations in Asia and Africa since mid-2025, The Hacker News reports. Sophos says the cluster’s most distinctive marker is its consistent use of Sandboxie DLL sideloading to deploy backdoors. The Hackread version was dropped as a duplicate.